Description
Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | varnish | 3.0.5-1 | — |
| Debian 12 | varnish | 3.0.5-1 | — |
| Debian 7 | varnish | 3.0.2-2+deb7u1 | DSA-2814-1 |
| Debian 6.0 | varnish | 2.1.3-8+deb6u1 | DSA-2814-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | varnish | 5.0.0-1.3 | openSUSE-SU-2024:10116-1 |
| openSUSE Tumbleweed | vinyl-cache | 9.0.0-1.1 | openSUSE-SU-2026:10751-1 |
Advisories 3
- openSUSE-SU-2026:10751-1 libvinylapi3-9.0.0-1.1 on GA media SUSE / openSUSE Security Updates · May 12, 2026
- DSA-2814-1 varnish - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10116-1 libvarnishapi1-5.0.0-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- openSUSE-SU-2013:1679 vendor-advisory
- DSA-2814 vendor-advisory
- [oss-security] 20131030 Re: CVE number needed for Varnish DoS, also heads-up mailing-list
- 20131030 [CVE-2013-4484] DoS vulnerability in Varnish HTTP cache mailing-list
- openSUSE-SU-2013:1683 vendor-advisory
- https://www.varnish-cache.org/trac/ticket/1367
- 55746 third-party-advisory
- 55452 third-party-advisory